chore(client/android): adopt AGP 9.3.1 / Gradle 9.5.0, and tell CI about it

The bump itself came from Android Studio; this makes the rest of the repo
agree with it.

The toolchain line at the top of the root build file still claimed AGP 9.2.0
and Gradle 9.4.1, and both Android workflows named "AGP 9.2" as the reason
they pin JDK 21 — the sort of comment that is trusted precisely because it
looks maintained.

The Gradle caches also needed telling: they cache the DISTRIBUTION under
`~/.gradle/wrapper`, keyed on a hash of `*.gradle.kts` only. This bump moved
both files so the key changed anyway, but a wrapper-only bump would have
restored a key that can never contain the new distribution. The wrapper
properties are in the key now.

Verified with the workflows' own commands on the new toolchain:
`:app:testDebugUnitTest -PskipRustBuild --stacktrace --rerun-tasks` (the
screenshot job, 45 tasks from cold) and `:app:assembleDebug` including the
cargo-ndk native build. AGP 9.3.1 resolves no build-tools newer than the
37.0.0 both jobs install, so their sdkmanager lines still cover it.

.gitea/workflows/android-screenshots.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: JDK 21 (AGP 9.2 + Robolectric's SDK-36 android-all jar both want 17–21)
+      - name: JDK 21 (AGP 9.3 + Robolectric's SDK-36 android-all jar both want 17–21)
         uses: actions/setup-java@v4
         with:
           distribution: temurin
@@ -47,7 +47,10 @@ jobs:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: android-screenshots-${{ hashFiles('clients/android/**/*.gradle.kts') }}
+          # gradle-wrapper.properties is in the key on purpose: `~/.gradle/wrapper` caches the
+          # Gradle DISTRIBUTION, so a wrapper bump with no .gradle.kts change would otherwise
+          # restore a key that can never hold the new one.
+          key: android-screenshots-${{ hashFiles('clients/android/**/*.gradle.kts', 'clients/android/gradle/wrapper/gradle-wrapper.properties') }}
           restore-keys: android-screenshots-
 
       # Roborazzi renders Compose on the JVM (Robolectric Native Graphics). `-PskipRustBuild` keeps

.gitea/workflows/android.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: JDK 21 (AGP 9.2 runs on JDK 17–21, not the host default)
+      - name: JDK 21 (AGP 9.3 runs on JDK 17–21, not the host default)
         uses: actions/setup-java@v4
         with:
           distribution: temurin
@@ -81,7 +81,8 @@ jobs:
             ~/.gradle/caches
             ~/.gradle/wrapper
             target
-          key: android-${{ hashFiles('Cargo.lock', 'clients/android/**/*.gradle.kts') }}
+          # gradle-wrapper.properties is in the key on purpose — see android-screenshots.yml.
+          key: android-${{ hashFiles('Cargo.lock', 'clients/android/**/*.gradle.kts', 'clients/android/gradle/wrapper/gradle-wrapper.properties') }}
           restore-keys: android-
 
       - name: cargo-ndk

clients/android/build.gradle.kts

@@ -2,7 +2,7 @@
 // org.jetbrains.kotlin.android (it's an error under AGP 9). The Compose compiler plugin is declared
 // here (version + apply false) so modules can apply it version-less; its version pins the build's
 // Kotlin (compose-compiler and Kotlin release in lockstep), keeping them matched.
-// Toolchain: AGP 9.2.0 · Gradle 9.4.1 · Kotlin/Compose-compiler 2.3.21 · JDK 21 · Compose BOM
+// Toolchain: AGP 9.3.1 · Gradle 9.5.0 · Kotlin/Compose-compiler 2.3.21 · JDK 21 · Compose BOM
 // 2026.05.01 · compileSdk 37 · targetSdk 37 · minSdk 28.
 plugins {
     id("com.android.application") version "9.3.1" apply false